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Safe Session Tracking 

Choosing the right method 
is crucial for e-commerce 
success. 

Stan Kim 



Session tracking is essential for Web applications, particularly for 
important e-commerce applications like shopping carts where a user's 
screen choices must be remembered. What follows is a brief overview of 
session tracking mechanisms and a recommendation for how to employ 
them; however, I don't discuss how you might save data that is to be 
used across multiple sessions that can be handled by servlets writing to a 
database via an Objective Relational Mapping Framework (ORMF), or 
directly through Java Database Connectivity (JDBC) or through entity 
Enterprise Java Beans (EJB). This article also focuses primarily on session 
tracking using Java servlets. Also, note that session tracking is only an 
issue for Web browser clients as standalone clients can easily keep track 
of state locally. 

Web applications often need to retain the state of user sessions. For 
example, when a customer buys books from an online bookseller, he uses 
an online shopping cart to select books before checking out. The shopping 
cart is only valid for the session and is abandoned if the shopper leaves 
the site for a certain amount of time without proceeding to checkout. A 
user's identity is also session information— because HTTP is 
connectionless, a server would need to ask the user to identify himself 
every time he requests a page if some type of session-tracking 
mechanism wasn't available. 

Fortunately, there are mechanisms for saving session information: user 
authorization, cookies, URL rewriting, hidden form fields, HTTPSession and 
stateful session Enterprise Java Beans. 

Most Web servers allow files or directories to be protected by forcing user 
authorization. User authorization prompts the user for a login and 
password and then validates the information. Once logged in, a servlet 
can obtain the remote user's identity by calling the getRemoteUser o 
method of HTTPServietRequest. The remote user name can be used to 
identify the user and session-specific information stored in a shared Java 
class or in an external database. This technique is easy to implement and 
allows the user to easily access the Web site from different machines. This 
technique Isn't free of disadvantages, however: The user must enter a 
login and password to perform session tracking, and using this technique 
for a shopping site forces the user to create an account and log in prior to 
adding items to his shopping cart— usually such e-commerce sites allow 
users to add items to a shopping cart before creating an account. 

A cookie is data stored with a Web browser^ such as Netscape Navigator 
or Microsoft Internet Explorer that can be used to perform session 
tracking. A user's cookie can be created, read or modified server-side 
using CGI scripts or via servlets. When the Web browser receives a 
cookie, it's saved to the user's hard disk and subsequently transmitted 
each time a page is accessed on the server. A servlet can read a user's 
cookies using method getcookies () of HTTPServietRequest, and a 
servlet can create and set a cookie using addcookie (Cookie cookie) of 
HTTPServletResponse. Cookies are easy to understand and implement; 
however, there are drawbacks. If a Web site uses stored cookies to store 
sensitive information, operators of less reputable sites may read this 
information. There has been much controversy regarding privacy concerns 
related to how companies such as Doubleclick and Media Metrix use 
cookies to monitor user Web browsing and Web shopping patterns. For 
these reasons, some users disable cookies in their Web browser, not 
allowing cookies to be used as a session-tracking mechanism. 

URL Rewriting allows you to track sessions by dynamically modifying the 
URL a user accesses to include additional information such as a session 
ID. However, this can result in frequent clashes with true paths and 
parameters that are appended to the URL. This technique is rarely used 
because there are easier and less intrusive methods of tracking sessions. 

Hidden form fields allow session tracking by adding fields to an HTML form 
that aren't displayed by the client's form. The data stored in these hidden 
form fields are sent to the server when the form is submitted. A form field 
is concealed by declaring its type as hidden. For example, as a user shops, 
the product IDs of items a user has added to his shopping cart, can be 
added as hidden form fields. This technique is supported by all Web 
browsers and doesn't require any form of user authorization; however, its 
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usefulness is limited because it only works for a sequence of dynamically 
generated forms. 

You can also use stateful session Enterprise Java Beans to capture the 
user state with an EJ8 implementation. This technique is often used with 
cookies for identifying the user. For example, a user's cookie could store a 
session ID created by a servlet, and the servlet could also store with a 
shopping cart session bean, the session ID it is associated with. To create 
a page that displays the user's shopping cart, a servlet could read the 
session ID from a cookie and use it as a key to locate the user's shopping 
cart via JNDI and home interface's finder methods. 
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HTTPSession is Sun's Java Servlet API- class for user session tracking. A 
servlet engine will usually use a cookie to assign a user a temporary user 
ID, which is associated with an HTTPSession. The HTTPSession object then 
lives in the servlet engine until the user exceeds the default time limit for 
inactivity, the servlet engine shuts down, or session object is forcibly 
"invalidated" by a servlet. The HTTPSession object can be used to store 
and retrieve data that needs to be maintained for a session such as 
shopping cart information. Servlets can create per user and session 
objects and bind them to names (like JNDI) for use later in the same 
session. HTTPSession session tracking technique is similar to stateful 
session EJBs except HTTPSession manages data bearing objects in servlet 
container, whereas stateful session EJB manages data bearing objects in 
EJB container. 

The Six Rules of Session Tracking 

• Use cookies only for user identification. A user ID may be stored in 
the cookie so a user with can be greeted with the phrase "Welcome Back, 
Bob." Of course, "Bob" would still need to log in to perform more 
sensitive functions such as ordering, using his credit card number on file. 

• Don't store any data besides a user's identification in cookies. This 
avoids privacy and security issues created by storing too much 
information in cookies. And never store sensitive data such as credit card 
numbers, social security numbers, phone numbers or addresses in a 
cookie. 

• Use the HTTPSession tracking mechanism if a servlet (not EJB) 
implementation is used. And use stateful session EJBs when using an 
EJB implementation. 

• Save any data that needs to be persistent for an indefinite time 
period to a backend database. A shopping application may provide a 
way to persist a shopping cart so a user can continue shopping another 
day. When the user accesses his shopping cart from the previous day, the 
data from the saved shopping card can be used to initialize a new 
shopping cart for the session. 

• User authorization may be used for very simple applications. 
However, for most applications, this method of session tracking is 
insufficient. 

• URL rewriting and hidden form field techniques should be 
avoided. The primary techniques used for session tracking should 
HTTPSession and stateful session EJBs in combination with a restricted 
use of cookies. 

Since session tracking is critical for most non-trivial Web aplications, 
selecting the right session tracking mechanism is an important decision. 
Key factors to consider are security, ease of use and how well the 
technique melds with the overall system architecture. You should carefully 
examine the advantages and disadvantages of each method when building 
session tracking capability into a Web site. 
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